CVE Vulnerabilities

CVE-2017-14149

NULL Pointer Dereference

Published: Sep 05, 2017 | Modified: Apr 20, 2025
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:N/I:N/A:P
RedHat/V2
RedHat/V3
Ubuntu

GoAhead 3.4.0 through 3.6.5 has a NULL Pointer Dereference in the websDecodeUrl function in http.c, leading to a crash for a POST / HTTP/1.1 request.

Weakness

The product dereferences a pointer that it expects to be valid but is NULL.

Affected Software

Name Vendor Start Version End Version
Goahead Embedthis 3.4.0 (including) 3.4.0 (including)
Goahead Embedthis 3.4.1 (including) 3.4.1 (including)
Goahead Embedthis 3.4.2 (including) 3.4.2 (including)
Goahead Embedthis 3.4.3 (including) 3.4.3 (including)
Goahead Embedthis 3.4.4 (including) 3.4.4 (including)
Goahead Embedthis 3.4.5 (including) 3.4.5 (including)
Goahead Embedthis 3.4.6 (including) 3.4.6 (including)
Goahead Embedthis 3.4.7 (including) 3.4.7 (including)
Goahead Embedthis 3.4.8 (including) 3.4.8 (including)
Goahead Embedthis 3.4.9 (including) 3.4.9 (including)
Goahead Embedthis 3.4.10 (including) 3.4.10 (including)
Goahead Embedthis 3.4.11 (including) 3.4.11 (including)
Goahead Embedthis 3.4.12 (including) 3.4.12 (including)
Goahead Embedthis 3.5.0 (including) 3.5.0 (including)
Goahead Embedthis 3.6.0 (including) 3.6.0 (including)
Goahead Embedthis 3.6.1 (including) 3.6.1 (including)
Goahead Embedthis 3.6.2 (including) 3.6.2 (including)
Goahead Embedthis 3.6.3 (including) 3.6.3 (including)
Goahead Embedthis 3.6.4 (including) 3.6.4 (including)
Goahead Embedthis 3.6.5 (including) 3.6.5 (including)

Potential Mitigations

References